TASK-059: sha256-pin PMD analyzer download in CI

Add integrity verification for the pmd-dist-7.24.0-bin.zip artifact
downloaded by the lint lane of verify-build.yml. Introduces a pinned
PMD_SHA256 alongside the existing PMD_VERSION and pipes the pair into
`sha256sum -c -` immediately after the curl invocation, so a tampered
or substituted zip aborts the step before unzip/install.

A rotation-procedure comment block is added above the run: scalar so
future PRs that bump PMD_VERSION are reminded to update PMD_SHA256
in the same change. No TODO comment existed on this step to remove.

Local falsification rehearsal (Step A of the plan):
  - Wrong digest (all zeros) on real zip: sha256sum -c - -> FAILED, exit=1
  - Tampered zip (one byte flipped at offset 1000) against the
    real digest: sha256sum -c - -> FAILED, exit=1
  - Pristine zip against real digest: -> OK, exit=0

Real digest sourced by `shasum -a 256` of a freshly downloaded
pmd-dist-7.24.0-bin.zip from the GitHub release page (the upstream
.sha256 companion file is not published for this release; the
download-and-hash fallback documented in the plan was used).

Out of scope: the unrelated IWYU clang_18-branch TODO (~line 467)
and the libcurl-tarball SHA-256 TODO (~line 502) in the same file
are deliberately left untouched per the plan.

Author: etr

.github/workflows/verify-build.yml

@@ -440,10 +440,18 @@ jobs:
       # CPD is shipped as part of the PMD distribution. The apt package
       # is pinned to PMD 6.x; we want the modern PMD 7 CLI (`pmd cpd ...`)
       # to match the script. Java is pre-installed on ubuntu-latest.
+      #
+      # Supply-chain: pmd.zip is sha256-pinned. To rotate PMD, update
+      # BOTH PMD_VERSION and PMD_SHA256 in the same PR. Obtain the new
+      # digest from the GitHub release page's pmd-dist-<ver>-bin.zip
+      # asset (or `sha256sum` the freshly downloaded zip and commit
+      # the resulting value here).
       run: |
         PMD_VERSION=7.24.0
+        PMD_SHA256=110934b36d39c19094d1b77386931978093f238f2c2f1851748822b69c7367ac
         curl -fsSL -o /tmp/pmd.zip \
           "https://github.com/pmd/pmd/releases/download/pmd_releases%2F${PMD_VERSION}/pmd-dist-${PMD_VERSION}-bin.zip"
+        echo "${PMD_SHA256}  /tmp/pmd.zip" | sha256sum -c -
         sudo unzip -q -o /tmp/pmd.zip -d /opt
         sudo ln -sf "/opt/pmd-bin-${PMD_VERSION}/bin/pmd" /usr/local/bin/pmd
         pmd --version